email auth mistakes

Hello
there is someone can access to my emails via authenticating from domain.com:2095
I have changed the password of all emails and cpanel password also can, access to emails
I find that there are a php script can access to all of my databases via the dbuser=mysql
I don't if he can change the password of emails from mysql or viad that php script or not ?
any idea please ??